<?php
/**
 * This code will benchmark your server to determine how high of a cost you can
 * afford. You want to set the highest cost that you can without slowing down
 * you server too much. 10 is a good baseline, and more is good if your servers
 * are fast enough.
 *
 * Set this number in www/settings.php, the nZEDb_PASSWORD_HASH_COST setting.
 */
if (! isset($argv[1]) || ! is_numeric($argv[1]) || $argv[1] < 0.05) {
    exit(
		'You can pass in a target time, which will be used to determine the cost.'.PHP_EOL.
		'The target time is the amount of time it will take to hash a password.'.PHP_EOL.
		'Hashing of passwords happens when a user registers an account or their hash needs to be updated because it is insecure.'.PHP_EOL.
		'Values between 0.2 and 0.5 are recommended. The minimum is 0.05 for security reasons.'.PHP_EOL
	);
}
$timeTarget = $argv[1];

$cost = 7;
do {
    $cost++;
    $start = microtime(true);
    password_hash('test', PASSWORD_DEFAULT, ['cost' => $cost]);
    $end = microtime(true);
} while (($end - $start) < $timeTarget);

echo 'Appropriate Cost Found: '.$cost.PHP_EOL;